How Do AI Agents Manage Identity in Agentic Systems?

TL;DR

Securely propagating identity across multi-agent flows requires exchanging the user's token at every hop back to the identity provider, narrowing scope and audience at each node, and routing through API gateways. This verifies identity, establishes transitive trust, and blocks bad actors from injecting impersonated identities into the flow.

Transcript

Howdy everyone. Organizations are embracing gen AI and rag models and agentic systems. With that, we're starting to see a lot of challenges pop up. One of the challenges we're seeing is how do we propagate an identity across an agentic flow? And we really want to kind of dig into this now and see in agentic systems, how are we going to securely pro... Read More

Key Insights

• Identity propagation is the core challenge in agentic systems: as a request moves through multiple agent nodes and hops, each node must know who the user is so the right privileges and data can be returned to the correct person.
• Delegation patterns evolve from no delegation, where an application connects to a database without knowing the user, to trusted assertion, where an identity provider authenticates the user and the app asserts that identity (for example via SAML) to the database.
• Simple delegation works by having the application authenticate itself and create a token that is passed back and used to determine privilege, rather than asserting the user's identity directly.
• A bad actor can create their own agent, connect to a router, and pass in a stolen identity to impersonate a user, so merely propagating identity from the start point lets attackers claim someone else's privileges and data.
• Trusting the identity is a distinct challenge because an agent deep in a flow has no visibility into where the user originally authenticated, so it cannot inherently know the incoming identity is legitimate.
• On-behalf-of delegation gives both the agent and user their own identities, tokens, and rights, with the user trusting the agent to act for them; dynamic flows introduce transitive trust, where the user trusts the whole system rather than each individual agent.
• Token exchange at each hop is the key defense: going back to the identity provider to exchange the token at every node validates endpoints against the known flow, so mismatched endpoints reveal injected impersonators and get rejected.
• Leveraging scope and audience narrows what a user can do at each node down to just the needed database access, and setting the next hop as the audience means an agent rejects any exchanged token whose audience is incorrect or missing.

Questions & Answers

Q: How do AI agents securely propagate identity across an agentic flow?

Identity is propagated by exchanging the user's token at each node along the flow, going back to the identity provider to exchange the original token at every hop. Because an agentic flow has known endpoints and hops, each exchange validates that the incoming and outgoing endpoints match the known flow. This verifies identity and establishes trust, preventing bad actors from injecting impersonated identities that would not match the known endpoints.

Q: What is the difference between no delegation, trusted assertion, and simple delegation?

No delegation means the application connects to the database on its own with a secure connection and knows nothing about the user. Trusted assertion introduces an identity provider: the user authenticates, and the application asserts who the user is to the database, for example through a SAML assertion, so privilege can be checked. Simple delegation instead has the application authenticate itself, create a token, pass it back, and use that token for privilege.

Q: Why is impersonation a risk in multi-agent systems?

In agentic flows with multiple nodes and hops, a bad actor can create their own agent or system, connect to a router, and pass in someone else's identity. In the example, one person impersonates another to take that user's privileges. If the system merely propagates identity from the starting point, there is no way to stop someone from inserting themselves and claiming to be a user to retrieve all the data and privileges that person is entitled to.

Q: What is transitive trust in agentic systems?

Transitive trust addresses the problem that agentic flows are dynamic and new agents get introduced, so a user cannot know or individually trust every agent throughout the system. With transitive trust, the user is not trusting each individual agent. Instead, they trust the system as a whole to act and behave on their behalf. This builds on the on-behalf-of delegation pattern where an agent works for the user, and extends it to many agents in a dynamic flow.

Q: How does token exchange prevent identity impersonation?

Token exchange means that at each hop along the agentic flow, the system goes back to the identity provider and exchanges the current token rather than passing the original token straight through. Because the flow has known endpoints and hops, each exchange evaluates whether the incoming and outgoing endpoints are the correct, expected ones. If someone tries to inject or impersonate an identity, it will not match the known flow or known endpoints, so it is rejected, verifying identity and establishing trust.

Q: Why should agentic systems use OAuth 2 and OpenID Connect?

OAuth 2 and OpenID Connect are recommended because they are established standards for identifying users and describing their rights and privileges, providing a common base for communication. This works especially well when one company talks to another, since both operate on the same industry standards, making cross-organizational interaction easy. Sticking to these standards gives agentic systems a shared foundation for propagating identity and evaluating what actions users are authorized to take.

Q: What role do scope and audience play in securing agentic flows?

Scope and audience narrow what a user can do as their token moves through the flow. Rather than allowing a user to do anything across the entire enterprise, scope is narrowed at each node down to only what they are authorized to do, ultimately just access to the target database. Audience is set to the next hop during token exchange, so a receiving agent should see itself as the audience; if the audience is incorrect or non-existent, it rejects the token, preventing injected impersonated identities.

Q: How do API gateways help connect agent nodes securely?

Connecting nodes and agents through APIs and API gateways leverages well-understood REST APIs and API economies. When one node connects to the next along the agentic flow through an API gateway, that gateway takes on the responsibility of performing the token exchange. It becomes the component that actually goes and exchanges the token, which removes the burden of doing that exchange from the individual agents or nodes in the flow, centralizing and standardizing the trust-establishing step.

Summary & Key Takeaways

• Organizations adopting gen AI, RAG, and agentic systems face the challenge of securely propagating a user's identity across flows. Identity propagation evolved through delegation patterns: no delegation, trusted assertion using an identity provider and SAML, and simple delegation where the application authenticates and passes a token back for privilege checks.

• Agentic flows add chatbots, routers, and multiple agent hops, creating new risks. A bad actor can build their own agent and inject a stolen identity to impersonate a user. Agents deep in a flow cannot see where authentication originated, raising the challenge of trusting the identity and accepting transitive trust across dynamic, on-behalf-of delegation.

• Strategies include standardizing on OAuth 2 and OpenID Connect, performing token exchange at each hop back to the identity provider to validate endpoints, narrowing scope and using audience to reject wrong recipients, and connecting nodes through API gateways that carry the burden of performing the token exchange.